[NETNS][FRAGS]: Make the net.ipv4.ipfrag_timeout work in namespaces.

[safe/jmp/linux-2.6] / net / ipv6 / netfilter / nf_conntrack_reasm.c

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index bff63d7..92a311f 100644 (file)
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -70,14 +70,43 @@ struct nf_ct_frag6_queue
        __u16                   nhoffset;
 };
 
-struct inet_frags_ctl nf_frags_ctl __read_mostly = {
+static struct inet_frags_ctl nf_frags_ctl __read_mostly = {
        .high_thresh     = 256 * 1024,
        .low_thresh      = 192 * 1024,
-       .timeout         = IPV6_FRAG_TIMEOUT,
        .secret_interval = 10 * 60 * HZ,
 };
 
 static struct inet_frags nf_frags;
+static struct netns_frags nf_init_frags;
+
+#ifdef CONFIG_SYSCTL
+struct ctl_table nf_ct_ipv6_sysctl_table[] = {
+       {
+               .procname       = "nf_conntrack_frag6_timeout",
+               .data           = &nf_init_frags.timeout,
+               .maxlen         = sizeof(unsigned int),
+               .mode           = 0644,
+               .proc_handler   = &proc_dointvec_jiffies,
+       },
+       {
+               .ctl_name       = NET_NF_CONNTRACK_FRAG6_LOW_THRESH,
+               .procname       = "nf_conntrack_frag6_low_thresh",
+               .data           = &nf_frags_ctl.low_thresh,
+               .maxlen         = sizeof(unsigned int),
+               .mode           = 0644,
+               .proc_handler   = &proc_dointvec,
+       },
+       {
+               .ctl_name       = NET_NF_CONNTRACK_FRAG6_HIGH_THRESH,
+               .procname       = "nf_conntrack_frag6_high_thresh",
+               .data           = &nf_frags_ctl.high_thresh,
+               .maxlen         = sizeof(unsigned int),
+               .mode           = 0644,
+               .proc_handler   = &proc_dointvec,
+       },
+       { .ctl_name = 0 }
+};
+#endif
 
 static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
                               struct in6_addr *daddr)
@@ -125,16 +154,11 @@ static inline void frag_kfree_skb(struct sk_buff *skb, unsigned int *work)
 {
        if (work)
                *work -= skb->truesize;
-       atomic_sub(skb->truesize, &nf_frags.mem);
+       atomic_sub(skb->truesize, &nf_init_frags.mem);
        nf_skb_free(skb);
        kfree_skb(skb);
 }
 
-static void nf_frag_free(struct inet_frag_queue *q)
-{
-       kfree(container_of(q, struct nf_ct_frag6_queue, q));
-}
-
 /* Destruction primitives. */
 
 static __inline__ void fq_put(struct nf_ct_frag6_queue *fq)
@@ -152,7 +176,7 @@ static __inline__ void fq_kill(struct nf_ct_frag6_queue *fq)
 
 static void nf_ct_frag6_evictor(void)
 {
-       inet_frag_evictor(&nf_frags);
+       inet_frag_evictor(&nf_init_frags, &nf_frags);
 }
 
 static void nf_ct_frag6_expire(unsigned long data)
@@ -188,7 +212,7 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
        arg.dst = dst;
        hash = ip6qhashfn(id, src, dst);
 
-       q = inet_frag_find(&nf_frags, &arg, hash);
+       q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
        if (q == NULL)
                goto oom;
 
@@ -357,7 +381,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
        skb->dev = NULL;
        fq->q.stamp = skb->tstamp;
        fq->q.meat += skb->len;
-       atomic_add(skb->truesize, &nf_frags.mem);
+       atomic_add(skb->truesize, &nf_init_frags.mem);
 
        /* The first fragment.
         * nhoffset is obtained from the first fragment, of course.
@@ -434,7 +458,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
                clone->ip_summed = head->ip_summed;
 
                NFCT_FRAG6_CB(clone)->orig = NULL;
-               atomic_add(clone->truesize, &nf_frags.mem);
+               atomic_add(clone->truesize, &nf_init_frags.mem);
        }
 
        /* We have to remove fragment header from datagram and to relocate
@@ -448,7 +472,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
        skb_shinfo(head)->frag_list = head->next;
        skb_reset_transport_header(head);
        skb_push(head, head->data - skb_network_header(head));
-       atomic_sub(head->truesize, &nf_frags.mem);
+       atomic_sub(head->truesize, &nf_init_frags.mem);
 
        for (fp=head->next; fp; fp = fp->next) {
                head->data_len += fp->len;
@@ -458,7 +482,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
                else if (head->ip_summed == CHECKSUM_COMPLETE)
                        head->csum = csum_add(head->csum, fp->csum);
                head->truesize += fp->truesize;
-               atomic_sub(fp->truesize, &nf_frags.mem);
+               atomic_sub(fp->truesize, &nf_init_frags.mem);
        }
 
        head->next = NULL;
@@ -608,7 +632,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
                goto ret_orig;
        }
 
-       if (atomic_read(&nf_frags.mem) > nf_frags_ctl.high_thresh)
+       if (atomic_read(&nf_init_frags.mem) > nf_frags_ctl.high_thresh)
                nf_ct_frag6_evictor();
 
        fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
@@ -682,12 +706,13 @@ int nf_ct_frag6_init(void)
        nf_frags.ctl = &nf_frags_ctl;
        nf_frags.hashfn = nf_hashfn;
        nf_frags.constructor = ip6_frag_init;
-       nf_frags.destructor = nf_frag_free;
+       nf_frags.destructor = NULL;
        nf_frags.skb_free = nf_skb_free;
        nf_frags.qsize = sizeof(struct nf_ct_frag6_queue);
        nf_frags.match = ip6_frag_match;
-       nf_frags.equal = ip6_frag_equal;
        nf_frags.frag_expire = nf_ct_frag6_expire;
+       nf_init_frags.timeout = IPV6_FRAG_TIMEOUT;
+       inet_frags_init_net(&nf_init_frags);
        inet_frags_init(&nf_frags);
 
        return 0;